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We propose an efficient quantum key distribution scheme based on entanglement. The sender 
chooses pairs of photons in one of the two equivalent nonmaximally entangled states randomly, and 
sends a sequence of photons from each pair to the receiver. They choose from the various bases 
independently but with substantially different probabilities, thus reducing the fraction of discarded 
data, and a significant gain in efficiency is achieved. We then show that such a refined data analysis 
guarantees the security of our scheme against a biased eavesdropping strategy. 
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Cryptography is the art of providing secure communication over insecure communication channels. To achieve this 
goal, an algorithm is used to combine a message with some additional information — known as the "key" — to produce 
a cryptogram. For this reason, secure key distribution is a crucial problem in cryptography. 

Since the publication of BB84 scheme proposed by Bennett and Brassard, there has been much interest in using 
quantum mechanics in cryptography The security of these quantum key distribution (QKD) schemes is based 

on the fundamental postulate of quantum physics that "every measurement perturbs a system" . Indeed, passive 
monitoring of transmitted signals is strictly forbidden in quantum mechanics. The "quantum no-cloning theorem" 
P,p"o[ indicates that it is impossible to make an exact copy of an unknown quantum state. 

Two well-known concepts for quantum key distribution are the BB84 scheme and the Ekert scheme 0. The 
BB84 scheme Q uses single photons transmitted between two parties (commonly called Alice and Bob). The sender 
Alice uses non-orthogonal quantum states to transfer the key to the receiver Bob. Such states cannot be cloned, 
hence any attempt by an eavesdropper, known as Eve, to get information on the key disturbs the transmitted signals 
and induces noise which will be detected during the second stage of the transmission. Alice and Bob randomly pick 
Oh, a subset of photons from those that are measured in correct bases and publicly compare their measurements. For 
these results, they estimate the average error rate e. If e turns out to be unreasonably large, then eavesdropping has 
occurred, all the data are discarded and they may re-start the whole procedure. 

The Ekert scheme 0] is based on entangled pairs and uses the generalized Bell's inequality (Clauser-Horne-Shimony- 
;; ;,r Holt inequality) Jll],[p|] to establish security. Both Alice and Bob receive one particle out of an maximally entangled 
pair. They perform measurements along at least three different directions on each side, where measurements along 
• i— i , parallel axes are used for key generation and oblique angles used for testing the inequality 

Neither scheme described above which is based on non-orthogonal quantum cryptography has an efficiency more 
than 50%. Recently, Lo et aL devise a modification 13 that essentially doubles the efficiency of the BB84 scheme, 
where, Alice and Bob choose between the two bases independently but with substantially different probabilities e and 
1 — e. They also prove the security of their scheme. 

In this paper, we present a new efficient QKD scheme with nonmaximally entangled states. Suppose Alice creates 
pairs of photons in the nonmaximally entangled state \AB) which can be transformed to its equivalent state \AB)' with 
the same Schmidt coefficients by local unitary transformations. She chooses pairs of photons in one of the two states 
randomly, and sends a sequence of photons out of each pair to Bob. The two users choose their bases independently 
with different probabilities and perform measurements. Similar to the scheme proposed by Lo et aL, as two parties 
are much more likely to be using the same basis, thus reducing the fraction of discarded data, a significant gain in 
efficiency is achieved. To ensure our scheme is secure, we separate the accepted data into various subsets according 
to the basis employed and estimate an error rate for each subset separately. We show that the refined error analysis 
is sufficient in ensuring the security of our scheme against "a biased eavesdropping attack" p3[. 
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In next section, we give the detailed description of our efficient QKD scheme with nonmaximally entangled states. 
By considering a simple biased eavesdropping strategy by Eve, we note that our refined analysis is an essential feature 
of our scheme in Sec. III. In Sec. IV, the constraint on the probability e is derived. Finally, we conclude the scheme 
in Sec. V. 

II. EFFICIENT QKD SCHEME WITH NONMAXIMALLY ENTANGLED STATES 

In our scheme, there are two parties: the sender, Alice and the receiver, Bob. Alice prepares pairs of photons in 
the nonmaximally entangled state 

\AB)=a\H) A \H) B +P\V) A \V) B (1) 

where \a\ 2 + \(3\ 2 = 1, and H and V denote the horizontal and vertical linear polarization, respectively. Then she 
performs two "a x " operations on the two particles respectively to transform the state \AB) to its equivalent state 

\AB)' = f3\H) A \H) B + a\V) A \V) B (2) 

with probability \. Photon B is sent to Bob and photon A is left for Alice. There are two types of measurements that 
Alice may perform: she may measure along the rectilinear basis, thus distinguishing between horizontal and vertical 
photons. Alternatively, she may measure along the diagonal basis, thus distinguishing between the +45° and —45° 
photons. Bob measures the polarizations at the other end. He measures in one of three bases, obtained by rotating 
rectilinear basis by angles <f>i ((/)[) — 0, (f> 2 (<p' 3 ) = tan -1 ^, </> 3 (<j)' 2 ) = — tan -1 ^. The surperscript ""' refers to the 
case in which Alice chooses \AB)' as the original state. 

The two users are connected by a quantum channel and a classical public channel. The quantum channel consists 
usually of an optical fiber. The public channel, however, can be any communication link. So how does this scheme 
work? 

1. Alice and Bob pick a number < e < I and make its value public. The constraint on e will be discussed in Sec. 
IV. 

2. Alice sends a sequence of photons B from each pair in one of the two nonmaximally entangled states (\AB) and 
\AB) ) chosen randomly and independently, and leaves the corresponding photons A. She also records her choice of 
\AB) or \AB)' . 

3. Alice has two types of measurements. One measurement along rectilinear basis (i.e., {\H) , |V)}) allows her to 
distinguish between horizontally and vertically polarized photons. The other measurement along diagonal basis (i.e., 

(\H) + \V)) , -j= (\H) - |V"})|) allows her to distinguish between photons polarized at +45° and -45°. Alice 

chooses between the two types with probabilities 1 — e and e, respectively. If she detects photon A in the state \H) 
or (\H) + \ V)), the result is 0; else, the measurement can yield the result I, and potentially reveal one bit of 
information. She writes down her measurement bases and the results of the measurements. 

4. For each photon, Bob performs measurements and registers the outcome of the measurements in one of three 
bases, obtained by rotating the rectilinear basis by angles <pi ((f)[) — 0, 4> 2 (^3) = tan -1 — , fa (<f>' 2 ) = — tan -1 — , i.e., 
{\H), \V)}, {a\H) + (3\V) ,/3\H) - a\V)}, and {(3 \H) + a \V) , a \H) - (3 \V)}, with probabilities 1 - e, §, and §, 
respectively. Similar to the measurements performed by Alice, each measurement can yield two results (if he detects 
photon Bmthesta,te\H), a\H)+(3\V) or (3\H) + a\V)) and 1 (if he detects photon B in the state \V), (3 \H) — a \V) 
or a \H) — (3 \ V)). The ensemble of these bits registered by both Alice and Bob is the raw key. 

5. After exchanging enough photons, Bob announces on the public channel the sequence of bases he used, but not 
the results that he obtained. 

6. Alice compares this sequence with the states that she originally chose, and the list of polarizations which she 
measured. Then she tells Bob on the public channel on which occasions his measurements have been done in the 
correct bases. Whenever Alice and Bob used the compatible basis, they should get perfectly correlated bits. However, 
due to imperfections in the setup, and to a potential eavesdropper, there will be some errors. 

There are two cases in which Alice chooses entangled states \AB) and \AB)' , respectively. For either of the two 
cases, both Alice and Bob are much more likely to choose the rectilinear basis and obtain correlated bits, thus 
achieving a significant gain in efficiency. If Alice chooses the diagonal basis, in order to generate a sifted key, Bob 
should choose between the bases {a \H) + /3 \V) , (3 \H) - a \V)}, and {(3 \H) + a\V) ,a\H) - (3 |V)} according to the 
entangled state chosen by Alice and the polarization of photon A. (Otherwise, if he uses the rectilinear basis, he gets 
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the outcomes and 1 with probabilities \a\ and \(3\ , respectively. These results abort.) Foe example, if Alice chooses 
the state \AB) and sends photon B to Bob. Then if she detects photon A polarized at +45° by measuring along 
the diagonal basis, Bob must choose the basis {a \ H) + (3 \ V) , (3 \ H) — a \ V)} and photon B would be detected in the 
state a \H) + (3 \ V). Therefore, they can generate a key bit "1" with probability i • e • | . The bases used by Alice and 

Bob agree with probability (1 — e) 2 + %■ which goes to 1 as e goes to zero. 



Table I. Example of the case where Alice chooses \AB) as the original state. The measurement bases are 
presented as the angles by which the rectilinear basis is rotated (here 9 — tan~ x £). The two users choose 
a basis with certain probability to measure their particles and register the bit value (0 or 1), respectively. 
The ensemble of these bits is the raw key. Alice tells Bob on the public channel on which occasions his 
measurements have been done in the correct bases, and they keep only the bits corresponding to the 
compatible bases. This is the sifted key. 
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7. For each of the two cases in which Alice chooses the entangled states \AB) or \AB)' , Alice and Bob divide up 
their polarization data into twelve cases according to the actual bases used and the bit values yielded (shown in Table 
I), respectively. Then they throw away the eight cases when they have used non-compatible basis. Since the total 
probabilities for the two users to obtain the results and 1 are equal, the ensemble of these bits of the remaining four 
cases is a sifted key. Hence, the remaining cases are kept for further analysis and to generate the secret key. 

8. Alice and Bob divide up the accepted data into two subsets according to the entangled states originally chosen 
by Alice. From the subset where Alice chooses \AB) as the prior state, there are three cases. In one case where Alice 
and Bob both use the rectilinear basis (including two cases shown in Table I, in each of which the bit value is "0" or 
"1"), they randomly pick a fixed number say mi photons and publicly compare their polarizations. The number of 
mismatches r\ (here, mismatch means the polarizations of photons are not correlated) tells them the estimated error 
rate ei = In the case where Alice uses the diagonal basis and Bob uses the basis {a \H) + (3 \V) , (3 \H) — a | V)}, 
they pick a fixed number say m 2 photons and publicly compare their polarizations. The number of mismatches r 2 
gives the estimated error rate e 2 = — . In the case where Alice uses the diagonal basis and Bob uses the basis 

G z 7712 G 

{(3 \H) + a \ V) , a \H) — (3 \ V)}, they pick a fixed number say m 3 photons and publicly compare their polarizations. 
The number of mismatches r 3 gives the estimated error rate e% = Similarly, from the subset where Alice chose 
\AB)' as the prior state, there are also three cases. Corresponding to the above discussion, we obtain the error rates 
e'i = —n-. e'n = ^\ and e'n = 

Note that the test samples mi, m^, 7712, m' 2 , m 3 and m' 3 are sufficiently large, the estimated error rates ei, e[, ei 1 
e 2 , e3, and e' 3 should be rather accurate 14 Now they demand that ei, e' x , 62, e 2 , e 3 , and e' 3 < e max where e max 
is a prescribed maximal tolerable error rate. If these independent constraints are satisfied, they proceed to the next 
steps. Otherwise, they throw away the polarization data and re-start the whole procedure. Notice that the constraints 
ei , e'i , &2 , e 2 , e 3 , and e' 3 < e max are more stringent than the original naive prescription e < e max (here e is the average 
error rate). We will discuss it in detail in Sec. III. 

9. Reconciliation and privacy amplification (see Ref. p 13 1). 



III. REFINED ERROR ANALYSIS 



For each photon, the eavesdropper, Eve does not know which nonmaximally entangled state it is chosen from. So 
for Eve, each photon is in an entangled mixed state. She has eavesdropping attack as below: 

i) . with a probability pi measures polarization of each photon along the rectilinear basis and re-sends a photon 
according to the result of her measurement to Bob; 

ii) . with a probability p 2 measures polarization of each photon along the basis {a \ H) + (3 \ V) , (3 \ H) — a \ V)} and 
re-sends a photon according to the result of her measurement to Bob; 

iii) . with a probability p 3 measures polarization of each photon along the basis {(3 \H) + a \ V) , a \ H) — (3 \ V)} and 
re-sends a photon according to the result of her measurement to Bob; 
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iv). with a probability 1 — p\ — p 2 — P3 does nothing. 

Eve has a whole set of eavesdropping strategies by varying the values of pi, p 2 and p^. Any of the strategies in this 
set is called "a biased eavesdropping attack" Q . 

Consider the error rate e\ (e[) for the case both Alice and Bob use the rectilinear basis. For the biased eavesdropping 
strategy under current consideration, errors occur only if Eve uses the other two bases. This happens with a conditional 
probability p 2 +P3- In this case, the polarization of the photon is randomized, thus giving an error rate 

ei(ei) = 2a 2 f3 2 (p 2 + P3 ). (3) 

Errors for the case where Alice uses the diagonal basis and Bob uses the basis {a \H) + (3 \V) , f3 \H) — a \V)} occur 
only if Eve is measuring along the rectilinear basis or the basis {(3 \ H) + a \ V) , a \ H) — (3 \ V)}. This happens with a 
conditional probability p± + P3 and when it happens, the photon polarization is randomized. Thus, the error rate for 
this case is 

e 2 (4) = 2a 2 (3 2 Pl + 8a 2 (3 2 (a 2 - (3 2 f p 3 . (4) 

Similarly, errors for the case where Alice uses the diagonal basis and Bob uses the basis {(3 \H) + a \ V) , a \H) — (3 \ V)} 
occur only if Eve is measuring along the rectilinear basis or the basis {a \H) + (3 \V) , (3 \H) — a | V)}. This happens 
with a conditional probability p\ + p 2 . In this case, the error rate is given as 

e 3 (4) = 2a 2 [3 2 Pl + Sa 2 (3 2 (a 2 - (3 2 ) 2 p 2 . (5) 
Therefore, Alice and Bob will find that, for the biased eavesdropping attack, the average error rate 



(l-e) 2 (ei+ei) + ^ (e 2 + e 3 



a 2 (3 2 



{l-ef 



2 (1 - ef ( P2 + pa) + e 2 Pl + 2e 2 (a 2 - (3 2 f (p 2 +p 3 ) 



(6) 



(l-e) 2 + f 

Suppose Eve always eavesdrops only along rectilinear basis (i.e., p\ = 1, p 2 = p 3 = 0), then 

a 2 (3 2 e 2 



(l- £ ) 2 + f 



(7) 



as e tends to 0, which is similar with the result of Ref. |l3J]. This means that if Eve is always eavesdropping along the 
dominant basis, with a naive error analysis prescribed as e < e max Alice and Bob will fail to detect eavesdropping by 
Eve. 

To ensure the security of our scheme, it is crucial to employ a refined data analysis: the accepted data are further 
divided into various subsets according to the actual basis used by Alice and Bob and the error rate of each subset is 
computed separately. In Sec. II, we have already computed the error rates e\, e[, ea, e' 2 , ea, and e' 3 < e max where 
e m ax is a prescribed maximal tolerable error rate. From Eqs. (3,4,5), we can see that these error rates e\, e[, e' 2 , 
e$, and e' 3 depend on Eve's eavesdropping strategy and the degree of entanglement of the original state, but not on 
the value of e. So the refined data analysis guarantees the security of the present scheme. 



IV. THE CONSTRAINT ON e 



From the above discussion, we know the value of e should be small but can not be zero. If e were actually zero, 
the scheme would be insecure. The main constraint on e is that there should be enough photons for an accurate 
estimation of the six error rates e%, e' 1; e 2 , e 2 , e 3 , and e 3 . We assume that N entangled pairs are chosen by Alice, i.e., 
N photons are transmitted from Alice to Bob. On average, for \AB) or |AB) only Ne 2 /8 photons belongs to each of 
the two cases where Alice uses the diagonal basis and Bob uses the basis {a \ H) + (3 \ V) , (3 \ H) — a \ V)} or the basis 
{(3 \H) + a \V) , a \H) — (3 \V)}. To estimate e 2 , e' 2 , 63, and e' 3 reasonably accurately, the number Ne 2 /8 should be 
larger than some fixed number say m = max (m 2 , m' 2 , TO3, m' 3 ). The numbers m 2 , m' 2 , rri3, and m' 3 are the photon 
number needed for the refined error analysis, which can be computed from classical statistical analysis. So 

Ne 2 /8 > m, (8) 

e > 2y/2m/N. 

As N tends to 00, e can tend to zero, but never reach it. And the efficiency of this scheme is asymptotic 100%. 
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V. DISCUSSION AND CONCLUSION 



From the refined error analysis, we find the error rates depend not only on Eve's eavesdropping strategy but also 
on the degree of entanglement of the original state. For the biased eavesdropping attack, the error rates and e\ 
(i = 1, 2, 3) are functions of a/3, the probability e and the eavesdropping strategy of Eve (seeing Eqs. (3-5)). If Alice 
uses a product state as the original state, i.e., a(3 — 0, whatever the probability e and Eve's eavesdropping strategy 
are, the error rates e, and e\ equal to zero. That is, Alice and Bob will never detect eavesdropping by Eve whatever 
she does. In other words, if a(3 = 0, the scheme is easily broken by an eavesdropper. The security of our scheme is 
relying on the degree of the entanglement of the original state. If \a(3\ = |, this scheme is equivalent to an efficient 
"simplified EPR scheme" ||. 

Of course, the QKD with nonmaximally entangled states may also be completed in another way. At first, the 



nonmaximally entangled state \AB) = a |00) + (3 |11) (here \f3\ < \a\) can be concentrated to an EPR state [jlG 17 
with probability 2 \(3\ 2 fis}] . If the concentration fails, EPR pairs are abandoned; else, they are used in an efficient 
"simplified EPR scheme" ||. Obviously, the total efficiency of this QKD process should be no more than 2 |/3| . 

In summary, we propose a quantum key distribution (QKD) scheme based on entanglement, where Alice and Bob 
choose between various bases independently with substantially different probabilities. Since two parties are much 
more likely to be using the same basis, thus reducing the fraction of discarded data, a significant gain in efficiency is 
achieved. The efficiency can be tend to 100%, as the value of e tends to zero (but can not reach it accurately). 

To make the scheme secure against the dominant basis eavesdropping attack, it is crucial to have a refined error 
analysis in place of a naive error analysis. We separate the accepted data into various subsets according to the basis 
employed and estimate an error rate for each subset separately. It is only when all error rates are small enough that 
the security of transmission is accepted. 
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